Changes between Version 5 and Version 6 of TIEDABACDemo
- Timestamp:
- 07/10/09 14:39:30 (15 years ago)
Legend:
- Unmodified
- Added
- Removed
- Modified
-
TIEDABACDemo
v5 v6 37 37 [[Image(Simple.png)]] 38 38 39 The image above shows a simple delegation. The GPO prinicpal has delegated the power to grant principals the GPO.demo attribute to USC by asserting that any USC.GENI principal also has the GPO.demo attribute. Ted has the GPO.demo attribute because he is a USC.GENI principal and all USC.GENI principals are GPO.demo prinicpals. The arrow between '''ISI.GENI''' and Ted is the familiar assertion by a principal assigning another principal the attribute; The arrow between '''GPO.demo''' and '''ISI.GENI''' represents a signed assertion about the two attributes. That attribute is signed by the GPO principal.39 The image above shows a simple delegation. The GPO prinicpal has delegated the power to grant principals the GPO.demo attribute to USC by asserting that any principal with the ISI.GENI attribute also has the GPO.demo attribute. We now show how to demonstrate that a given principal has a delegated attribute. 40 40 41 41 [[Image(Creds.png)]] 42 42 43 The image above shows how to walk the chain of attribute assignments and delegations to prove a principal has a given attribute. In this case, it shows that Ted has the GOP.demo attribute. Proving a principal has an attribute is equivalent to finding a path from principal to attribute in the graph induced above. We use this representation in our configuration and visualization tool to help administrators. 43 The image above shows how to walk the chain of attribute assignments and delegations to prove a principal has a given attribute. In this case, it shows that Ted has the GOP.demo attribute. Proving a principal has an attribute is equivalent to finding a path from principal to attribute in the graph induced above. The edges all represent credentials that the GPO or Ted are in possesion of that can be combined to demonstrate that Ted possesses the GPO.demo attribute. 44 45 We use this representation in our configuration and visualization tool to help administrators. 44 46 45 47 [[Image(Linked.png)]] 46 48 47 A linked role is specified by a different attribute that links the authorizing attribute (in parens) to the delegating attribute by a dot, and the arrow completes the delegation. 49 A linked role is specified by a different attribute that links the authorizing attribute (in parens) to the delegating attribute by a dot, and the arrow completes the delegation. The following shows the graphical representation of walking a chain of credentials that inclides a linked credential showing that Ted has the GPO.demo attribute. 48 50 49 51 [[Image(LinkedCreds.png)]] 52 53 This introduces two kind of links to the graph. The first is a link that represents a linked role, the link from the red box to the GPO.demo attribute represents a new kind of credential - one that defines conditions for delegation (a linked role) rather than a direct delegation. The presence of that credential, and the credential indicating that the NSF asserts that ISI is NSF.funded creates the blue dotted edge. No single credential represents that edge; the presence of both a credential defining the authorizing set for GPO.demo and one showing that ISI is in the authorizing set creates the edge. 54 55 Once the edge is present, again, showing that Ted has the GPO.demo attribute is a matter of showing the path.
